Summary
Kong Ingress Controller for Kubernetes (KIC): Secret-backed plugin configurations leak through non-sensitive diagnostics endpoint
A vulnerability in the Kong Ingress Controller (KIC) allows for the unauthorized exposure of sensitive plugin credentials through the diagnostics interface. Even when configured to redact sensitive information (using --dump-sensitive-config=false), KIC fails to sanitize the Plugins field in diagnostic configuration dumps. This causes secrets referenced via configFrom.secretKeyRef to be resolved and displayed in plaintext.
Because the diagnostics HTTP endpoints require no authentication, any process within the cluster network capable of reaching the KIC pod can exfiltrate sensitive data, including API keys, bearer tokens, and database passwords.
Am I affected?
You are affected if all of the following hold:
- You are using Kong Ingress Controller with diagnostics enabled (
--dump-config=true). - You have not explicitly enabled sensitive dumping (
--dump-sensitive-config=false), creating an expectation of redaction. - You use
KongPluginorKongClusterPluginresources that reference Kubernetes Secrets viaconfigFrom.secretKeyRef. - The KIC diagnostics port (default
10256) is reachable by other workloads or users within your cluster.
You are not affected if:
- The
--dump-configflag is set tofalse(default behavior). - You do not use secret-backed configurations in your Kong plugins.
- Access to the KIC pod's diagnostic port is strictly blocked by NetworkPolicies.
Mitigation
- Disable Diagnostics: If not actively debugging, disable the diagnostic server by setting
--dump-config=false. - Network Isolation: Implement a
NetworkPolicyto restrict access to the KIC diagnostics port (default10256), ensuring only authorized administrative pods or IPs can reach it. - Restrict Port-Forwarding: Limit
kubectl port-forwardRBAC permissions to prevent unauthorized users from accessing the pod's local ports.
Impact
Affected versions
Security releases
Kodem intelligence
Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.
Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.
Already deployed Kodem?
See it in your environmentNew to Kodem? Get a demo →Remediation advice
The fix introduces proper sanitization for the Plugins field within the configuration state. When sensitive dumping is disabled, the controller now replaces all plugin configuration values with a redaction placeholder before they are served via the diagnostics endpoints. Additionally, it is recommended to ensure your deployment environment follows the principle of least privilege regarding network access to controller components.
Users should upgrade to the latest patched version of Kong Ingress Controller to ensure diagnostic dumps are correctly redacted.
Frequently Asked Questions
- What is GHSA-3278-C88V-XRH4? GHSA-3278-C88V-XRH4 is a medium-severity security vulnerability in github.com/kong/kubernetes-ingress-controller/v2 (go), affecting versions <= 2.12.8. It is fixed in 3.5.7.
- Which packages are affected by GHSA-3278-C88V-XRH4?
github.com/kong/kubernetes-ingress-controller/v2(go) (versions <= 2.12.8)github.com/kong/kubernetes-ingress-controller(go) (versions <= 1.3.4)github.com/kong/kubernetes-ingress-controller/v3(go) (versions <= 3.5.6)
- Is there a fix for GHSA-3278-C88V-XRH4? Yes. GHSA-3278-C88V-XRH4 is fixed in 3.5.7. Upgrade to this version or later.
- Is GHSA-3278-C88V-XRH4 exploitable, and should I be worried? Whether GHSA-3278-C88V-XRH4 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
- What actually determines whether GHSA-3278-C88V-XRH4 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
- How do I fix GHSA-3278-C88V-XRH4? Upgrade
github.com/kong/kubernetes-ingress-controller/v3to 3.5.7 or later.